fileValidation.js

Go to the documentation of this file.

/**
 * @file File Upload Validation Middleware
 * @module middleware/fileValidation
 * @description
 * Provides comprehensive security validation for file uploads to prevent common
 * vulnerabilities and abuse. Validates file format, size, content, and filename
 * sanitization before processing uploads.
 *
 * Security features:
 * - **Malicious file prevention**: Whitelist-based extension filtering
 * - **DoS protection**: File size limits (default: 10MB)
 * - **Path traversal prevention**: Filename sanitization
 * - **Format validation**: Base64 format verification
 * - **Auto-sanitization**: Removes dangerous characters from filenames
 *
 * Supported file types:
 * - Documents: .pdf, .doc, .docx, .txt, .rtf
 * - Spreadsheets: .xls, .xlsx, .csv
 * - Images: .jpg, .jpeg, .png, .gif, .webp
 * - Archives: .zip, .tar, .gz
 * @example
 * // Apply to document upload routes
 * const { validateAttachments } = require('./middleware/fileValidation');
 * router.post('/documents', authenticateToken, validateAttachments, async (req, res) => {
 *   // req.body.attachments validated and sanitized
 *   const files = req.body.attachments;
 * });
 */
 
/**
 * Validates file upload data for security and format requirements.
 *
 * Performs comprehensive validation including filename sanitization, extension
 * whitelisting, size checking, base64 format verification, and path traversal
 * prevention. Returns validation result with sanitized filename on success.
 * @function validateFileUpload
 * @param {string} filename - Original filename from upload
 * @param {string} data_base64 - Base64 encoded file data (with or without data URL prefix)
 * @param {number} [maxSizeMB] - Maximum file size in megabytes (default: 10)
 * @returns {object} Validation result with isValid, error (if invalid), or sanitizedFilename/cleanedBase64/sizeInMB (if valid)
 * @example
 * const result = validateFileUpload('report.pdf', 'JVBERi0xLjQK...', 5);
 * if (result.isValid) {
 *   console.log('Sanitized:', result.sanitizedFilename);
 *   console.log('Size:', result.sizeInMB, 'MB');
 * } else {
 *   console.error('Error:', result.error);
 * }
 * @example
 * // Invalid extension
 * validateFileUpload('script.exe', 'TVqQAAMAAAA...')
 * // => { isValid: false, error: "File type .exe not allowed..." }
 * @example
 * // Path traversal attempt
 * validateFileUpload('../../etc/passwd', 'cm9vdDp4OjA6...')
 * // => { isValid: false, error: "Invalid characters in filename" }
 */
function validateFileUpload(filename, data_base64, maxSizeMB = 10) {
  // 1. Validate filename exists
  if (!filename || typeof filename !== 'string') {
    return {
      isValid: false,
      error: 'Filename is required'
    };
  }
 
  // 2. Validate base64 data exists
  if (!data_base64 || typeof data_base64 !== 'string') {
    return {
      isValid: false,
      error: 'File data is required'
    };
  }
 
  // 3. Validate file extension
  const allowedExtensions = [
    '.pdf', '.doc', '.docx', '.txt', '.rtf',  // Documents
    '.xls', '.xlsx', '.csv',                   // Spreadsheets
    '.jpg', '.jpeg', '.png', '.gif', '.webp',  // Images
    '.zip', '.tar', '.gz'                      // Archives
  ];
  
  const ext = filename.substring(filename.lastIndexOf('.')).toLowerCase();
  
  if (!ext || !allowedExtensions.includes(ext)) {
    return {
      isValid: false,
      error: `File type ${ext || 'unknown'} not allowed. Allowed types: ${allowedExtensions.join(', ')}`
    };
  }
 
  // 4. Validate base64 format
  // Remove data URL prefix if present (e.g., "data:image/png;base64,")
  let cleanedBase64 = data_base64;
  if (data_base64.includes(',')) {
    cleanedBase64 = data_base64.split(',')[1];
  }
 
  if (!/^[A-Za-z0-9+/]*={0,2}$/.test(cleanedBase64)) {
    return {
      isValid: false,
      error: 'Invalid file data format'
    };
  }
 
  // 5. Validate file size
  // Base64 encoding increases size by ~33%, so decode to get actual size
  const sizeInBytes = (cleanedBase64.length * 3) / 4;
  const sizeInMB = sizeInBytes / (1024 * 1024);
  
  if (sizeInMB > maxSizeMB) {
    return {
      isValid: false,
      error: `File size ${sizeInMB.toFixed(2)}MB exceeds limit of ${maxSizeMB}MB`
    };
  }
 
  // 6. Prevent path traversal in filename
  if (filename.includes('..') || filename.includes('/') || filename.includes('\\')) {
    return {
      isValid: false,
      error: 'Invalid characters in filename'
    };
  }
 
  // 7. Sanitize filename - remove dangerous characters
  const sanitizedFilename = filename
    .replace(/[^a-zA-Z0-9._-]/g, '_')  // Replace special chars with underscore
    .substring(0, 255);                 // Limit length
 
  // 8. Ensure filename isn't empty after sanitization
  if (!sanitizedFilename || sanitizedFilename === ext) {
    return {
      isValid: false,
      error: 'Filename must contain valid characters'
    };
  }
 
  return {
    isValid: true,
    sanitizedFilename,
    cleanedBase64,
    sizeInMB: sizeInMB.toFixed(2)
  };
}
 
/**
 * Express middleware for validating array of file attachments in request body.
 *
 * Validates all files in req.body.attachments array. Replaces attachments with
 * validated objects containing sanitized filenames and cleaned base64 data. Returns
 * 400 error if any attachment fails validation.
 * @function validateAttachments
 * @param {object} req - Express request object
 * @param {object} req.body - Request body
 * @param {object[]} [req.body.attachments] - Array of attachment objects
 * @param {string} req.body.attachments[].filename - Original filename
 * @param {string} req.body.attachments[].data - Base64 encoded file data
 * @param {object} res - Express response object
 * @param {Function} next - Express next middleware function
 * @returns {void} Modifies req.body.attachments with validated data or sends 400 error
 * @throws {400} Invalid attachment - Validation failed for one or more files
 * @example
 * // Request body with attachments
 * {
 *   "title": "Monthly Report",
 *   "attachments": [
 *     {
 *       "filename": "report.pdf",
 *       "data": "JVBERi0xLjQKJcfs..."
 *     }
 *   ]
 * }
 * @example
 * // After middleware, req.body.attachments contains
 * [
 *   {
 *     "filename": "report.pdf",
 *     "sanitizedFilename": "report.pdf",
 *     "data": "JVBERi0xLjQKJcfs...",
 *     "sizeInMB": "0.45"
 *   }
 * ]
 * @example
 * // Error response
 * {
 *   "error": "Invalid attachment: File type .exe not allowed..."
 * }
 */
function validateAttachments(req, res, next) {
  const { attachments } = req.body;
 
  // If no attachments, skip validation
  if (!attachments || !Array.isArray(attachments) || attachments.length === 0) {
    return next();
  }
 
  const validatedAttachments = [];
  const errors = [];
 
  for (let i = 0; i < attachments.length; i++) {
    const attachment = attachments[i];
    
    if (!attachment.filename || !attachment.data) {
      errors.push(`Attachment ${i + 1}: Missing filename or data`);
      continue;
    }
 
    const result = validateFileUpload(attachment.filename, attachment.data);
 
    if (!result.isValid) {
      errors.push(`Attachment "${attachment.filename}": ${result.error}`);
    } else {
      validatedAttachments.push({
        filename: result.sanitizedFilename,
        data: result.cleanedBase64,
        originalFilename: attachment.filename,
        size: result.sizeInMB
      });
    }
  }
 
  if (errors.length > 0) {
    return res.status(400).json({
      error: 'File validation failed',
      details: errors
    });
  }
 
  // Replace original attachments with validated ones
  req.body.validatedAttachments = validatedAttachments;
  next();
}
 
module.exports = {
  validateFileUpload,
  validateAttachments
};